302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5

Analysis

max time kernel
137s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
Size 999KB
Sample240527-y939eaac48
SHA256 302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5
MD5 c3ca90f3772c58d5357160b487b0232d
SHA1 c23ea6811ac0c528fdd51070b1fb391280b61ca8
SHA512 ea5c0f56bd4a86fc392f42092212757759dc75059c47d82ecda50c09e64c0d082d46e85c659dafc80d5a38465be4f496f6dda580ad8cd331b8244a924307b59f
SSDEEP 12288:Kmix1c60yluFhNGpW785bM3npxYfj63hgD1ZiQ85bM3npxYfj63hgD1Zip:ouFhNGpW33npi63ip3npi63iO
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/1016-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0002000000022a4b-5.dat	UPX
behavioral2/memory/1016-1875-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1016-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0002000000022a4b-5.dat	upx
behavioral2/memory/1016-1875-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File created	\??\c:\Program Files\desktop.ini	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\desktop.ini	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jhat.exe	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\he.txt	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ko.pak	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\ado\msadomd28.tlb	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jstack.exe	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\kab.txt	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\mraut.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\it.pak	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ast.txt	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\BlockGrant.docm	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado15.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File created	\??\c:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\tr.txt	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\zh-cn.txt	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Logo.png	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File created	\??\c:\Program Files\Internet Explorer\ieinstal.exe	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File created	\??\c:\Program Files\Common Files\System\wab32.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\VC\msdia90.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File created	\??\c:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll	302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3088	1016	WerFault.exe	89

C:\Users\Admin\AppData\Local\Temp\302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe
"C:\Users\Admin\AppData\Local\Temp\302150b22ab2f3633573c429c13bb05e038822d213767c8dc699c8d843fa86a5.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 760
  2⤵
  - Program crash
  PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4420,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1016 -ip 1016
1⤵
PID:968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip32.dll

Path C:\Program Files\7-Zip\7-zip32.dll
Size 1.0MB
SHA256 d3691a8f4c5a188208ee6de0e0c18c58dd98e871cbdbba540b1a7085d9a95285
MD5 68addb90facf305282690fcdd5180250
SHA1 18b2d2dc0c7196fc6cf2ad16f4f483149a0bdc39
SHA512 009464d9682b2ac43bfc72c03d2e52e6cc0e2748083b9e4d8826da94e9fb6e6af07dbb50713dfef0537603afeedb604e490e44c5e1cc36256334c099357cf3f8
SSDEEP 12288:Kmix1c60yluFhNGpW785bM3npxYfj63hgD1ZiQ85bM3npxYfj63hgD1Zi+C0Eu:ouFhNGpW33npi63ip3npi63ivC0Eu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReachFramework.dll

Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll
Size 5B
SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
MD5 b5b682b742431a52ea8b17c72ad9c572
SHA1 326320f469235708c59f678c9a7357dca552d306
SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
MD5 SHA1 SHA512